Buggy code:
public static HTTPUtilities getInstance ( ) { } private class ThreadLocalRequest extends InheritableThreadLocal < HttpServletRequest > { public HttpServletRequest getRequest ( ) { } public HttpServletRequest initialValue ( ) { } public void setRequest ( HttpServletRequest newRequest ) { } } private class ThreadLocalResponse extends InheritableThreadLocal < HttpServletResponse > { public HttpServletResponse getResponse ( ) { } public HttpServletResponse initialValue ( ) { } public void setResponse ( HttpServletResponse newResponse ) { } } private final Logger logger = ESAPI . getLogger ( "HTTPUtilities" ) ; static final int maxBytes = ESAPI . securityConfiguration ( ) . getAllowedFileUploadSize ( ) ; private DefaultHTTPUtilities . ThreadLocalRequest currentRequest = new DefaultHTTPUtilities . ThreadLocalRequest ( ) ; private DefaultHTTPUtilities . ThreadLocalResponse currentResponse = new DefaultHTTPUtilities . ThreadLocalResponse ( ) ; public DefaultHTTPUtilities ( ) { } public void addCookie ( Cookie cookie ) { } public void addCookie ( HttpServletResponse response , Cookie cookie ) { } public String addCSRFToken ( String href ) { } public void addHeader ( String name , String value ) { } public void addHeader ( HttpServletResponse response , String name , String value ) { } public void assertSecureChannel ( ) throws AccessControlException { } public void assertSecureChannel ( HttpServletRequest request ) throws AccessControlException { } public void assertSecureRequest ( ) throws AccessControlException { } public void assertSecureRequest ( HttpServletRequest request ) throws AccessControlException { } public HttpSession changeSessionIdentifier ( ) throws AuthenticationException { } public HttpSession changeSessionIdentifier ( HttpServletRequest request ) throws AuthenticationException { } public void clearCurrent ( ) { } private String createCookieHeader ( String name , String value , int maxAge , String domain , String path , boolean secure ) { } public String decryptHiddenField ( String encrypted ) { } public Map < String , String > decryptQueryString ( String encrypted ) throws EncryptionException { } public Map < String , String > decryptStateFromCookie ( ) throws EncryptionException { } public Map < String , String > decryptStateFromCookie ( HttpServletRequest request ) throws EncryptionException { } public String encryptHiddenField ( String value ) throws EncryptionException { } public String encryptQueryString ( String query ) throws EncryptionException { } public void encryptStateInCookie ( HttpServletResponse response , Map < String , String > cleartext ) throws EncryptionException { } public void encryptStateInCookie ( Map < String , String > cleartext ) throws EncryptionException { } public String getCookie ( HttpServletRequest request , String name ) throws ValidationException { } public String getCookie ( String name ) throws ValidationException { } public String getCSRFToken ( ) { } public HttpServletRequest getCurrentRequest ( ) { } public HttpServletResponse getCurrentResponse ( ) { } public List < File > getFileUploads ( ) throws ValidationException { } public List < File > getFileUploads ( HttpServletRequest request ) throws ValidationException { } public List < File > getFileUploads ( HttpServletRequest request , File finalDir ) throws ValidationException { } public List < File > getFileUploads ( HttpServletRequest request , File finalDir , List allowedExtensions ) throws ValidationException { } private Cookie getFirstCookie ( HttpServletRequest request , String name ) { } public String getHeader ( HttpServletRequest request , String name ) throws ValidationException { } public String getHeader ( String name ) throws ValidationException { } public String getParameter ( HttpServletRequest request , String name ) throws ValidationException { } public String getParameter ( String name ) throws ValidationException { } public void killAllCookies ( ) { } public void killAllCookies ( HttpServletRequest request , HttpServletResponse response ) { } public void killCookie ( HttpServletRequest request , HttpServletResponse response , String name ) { } public void killCookie ( String name ) { } public void logHTTPRequest ( ) { } public void logHTTPRequest ( HttpServletRequest request , Logger logger ) { } public void logHTTPRequest ( HttpServletRequest request , Logger logger , List parameterNamesToObfuscate ) { } private Map < String , String > queryToMap ( String query ) { } public void sendForward ( HttpServletRequest request , HttpServletResponse response , String location ) throws IOException , ServletException , AccessControlException { } public void sendForward ( String location ) throws IOException , ServletException , AccessControlException { } public void sendRedirect ( HttpServletResponse response , String location ) throws IOException , AccessControlException { if ( ! ( ESAPI . validator ( ) . isValidRedirectLocation ( "Redirect" , location , false ) ) ) { logger . fatal ( SECURITY_FAILURE , ( "Bad<seq2seq4repair_space>redirect<seq2seq4repair_space>location:<seq2seq4repair_space>" + location ) ) ; <START_BUG> throw new IOException ( "Redirect<seq2seq4repair_space>failed" ) ; <END_BUG> } response . sendRedirect ( location ) ; } public void sendRedirect ( String location ) throws IOException , AccessControlException { } public void setContentType ( ) { } public void setContentType ( HttpServletResponse response ) { } public void setCurrentHTTP ( HttpServletRequest request , HttpServletResponse response ) { } public void setHeader ( HttpServletResponse response , String name , String value ) { } public void setHeader ( String name , String value ) { } public void setNoCacheHeaders ( ) { } public void setNoCacheHeaders ( HttpServletResponse response ) { } public String setRememberToken ( HttpServletRequest request , HttpServletResponse response , String password , int maxAge , String domain , String path ) { } public String setRememberToken ( String password , int maxAge , String domain , String path ) { } public void verifyCSRFToken ( ) throws IntrusionException { } public void verifyCSRFToken ( HttpServletRequest request ) throws IntrusionException { } public < T > T getSessionAttribute ( String key ) { } public < T > T getSessionAttribute ( HttpSession session , String key ) { } public < T > T getRequestAttribute ( String key ) { } public < T > T getRequestAttribute ( HttpServletRequest request , String key ) { } private String encryptString ( String plaintext ) throws EncryptionException { } private String decryptString ( String ciphertext ) throws EncryptionException { } }

Fix:
throw new AccessControlException ( "Redirect<seq2seq4repair_space>failed" ) ;